Authenticate every API request
Use an Authorization: Bearer header for protected API routes. Application integration keys use mv_ followed by 64 hexadecimal characters. Customer account sessions use mvs_; creating or rotating an integration key requires an active customer account session.
Authorization: Bearer <your-api-key>Never place a key in a URL, commit it to source control, include it in analytics, or log request authorization headers.
Issue a client key
After your account is activated, open Workspace → Account & API keys to create an integration key. Save it securely; the key is displayed once. Contact your administrator if you use an API-only account.
- Keep each application’s credential separate.
- Treat allowed_hosts and limits from GET /api/v1/me as the client’s current configuration.
- HTTP 401 means the supplied key is invalid or revoked. Obtain a valid key from your operator.
Rotate or disable customer access
Rotate your integration key in Workspace → Account & API keys. Choose a grace period of 0–3600 seconds so your application can switch to the replacement. Contact your administrator to disable account access.
Protect the newly issued key and update your application server configuration.
Keep application keys on your server
For your own application, call ModeraLens from a trusted backend. Do not embed keys in browser JavaScript, mobile apps, or publicly exposed environment variables.
The workspace accepts an integration key for the current browser session and clears it on disconnect or reload. Use this connection only on a trusted device.
const response = await fetch(`${process.env.MODERAVAULT_API_URL}/api/v1/me`, {
headers: {
Authorization: `Bearer ${process.env.MODERALENS_API_KEY}`,
Accept: "application/json",
},
});
if (!response.ok) throw new Error(`API returned ${response.status}`);
const { data: client } = await response.json();Client isolation
A client can only retrieve its own jobs. GET /api/v1/jobs/{id} returns HTTP 404 both for missing jobs and jobs owned by another client. This avoids exposing another client’s records.